International Data Protection Day: Brazilian scenario characterized by Authority’s leading and the rise of lawsuits

On January 28th, we celebrate International Data Protection Day, a significant occasion to reflect on regulatory progress and the challenges faced in the realm of privacy and information security.

Looking back over 2024, numerous actions involving personal data have emerged as milestones for the progress of the subject.

The publication of the 2025–2026 Regulatory Agenda by the National Data Protection Authority (ANPD) – which marked its fourth year of existence – deserves special attention. This new agenda has been structured into phases to ensure greater transparency and efficiency in addressing fundamental issues, such as data subjects’ rights, the protection of sensitive data and data related to children and adolescents, anonymization, artificial intelligence, and the continuation of previously reiterated topics.

Another regulatory milestone of 2024 was the launch of a dedicated page addressing International Data Transfers (TID). This initiative, governed by Resolution CD/ANPD No. 19/2024, aims to enhance transparency and facilitate the compliance of data controllers and processors with the provisions of the Brazilian Data Protection Regulation (LGPD).

Additionally, in the same year, ANPD published a guide on the application of legitimate interest as a legal basis for personal data processing. This document sets forth rigorous criteria and parameters for the proper use of this legal basis, notably including a three-step test: purpose, necessity, and balancing. Another significant guide is related to the role of the DPO (data protection officer), providing deeper detail on their duties and responsibilities.

In practical terms, ANPD also approved the Communication of Security Incidents Regulation (Resolution No. 15/2024), which determines that both ANPD and data subjects affected by eventual incident must be notified within three business days, as well as specifies the required information to be provided.

The examples abovementioned demonstrates that ANPD has been concentrating its efforts on promoting awareness, conducting studies, and encouraging the adoption of measures to assist both data subjects and data processing agents.

Moreover, data shows that more than 14,000 judicial decisions from the main Brazilian Courts mentioned LGPD as their reasoning in 2024, reflecting exponential growth compared to previous years. There are no cases of extreme significance or high-value damages reported, but numerous decisions involving consumer protection increase significantly the volume of cases in Brazil.

Our Digital Law team is closely monitoring developments on this matter and their impact in Brazil. Should you wish to receive further information on the topic, please contact us via email at digital@kasznarleonardos.com.